Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 05:23

General

  • Target

    b476192616b9cece95c9071605ecce3902e64beb8e67ca7336b3f3f75411fdfe.exe

  • Size

    661KB

  • MD5

    ed7695b5b954ca353713414660616cae

  • SHA1

    5bfb7d46c2620043abfe19337ab791358c965be6

  • SHA256

    b476192616b9cece95c9071605ecce3902e64beb8e67ca7336b3f3f75411fdfe

  • SHA512

    07a2a739a26eb65adfa184612df8603e51385979013803b8921ad4713fa029dca673e0c004a9c42b03a93715c9e66f717eda33008aa462288077b1674708f46d

  • SSDEEP

    12288:v8KFAGRJlG+7rz/Xx5GjIW0ep9Rr2M/iTGYqWofv1zSFXMhuV+7+bY:vbY47GECyCiuW095ugcY

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b476192616b9cece95c9071605ecce3902e64beb8e67ca7336b3f3f75411fdfe.exe
    "C:\Users\Admin\AppData\Local\Temp\b476192616b9cece95c9071605ecce3902e64beb8e67ca7336b3f3f75411fdfe.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Nonruinous=Get-Content -raw 'C:\Users\Admin\AppData\Local\Mixende\Klausuleringerne\Kodrivernes.Leg';$Perpetuities228=$Nonruinous.SubString(53155,3);.$Perpetuities228($Nonruinous)
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2076-8-0x0000000074171000-0x0000000074172000-memory.dmp

    Filesize

    4KB

  • memory/2076-9-0x0000000074170000-0x000000007471B000-memory.dmp

    Filesize

    5.7MB

  • memory/2076-10-0x0000000074170000-0x000000007471B000-memory.dmp

    Filesize

    5.7MB

  • memory/2076-11-0x0000000074170000-0x000000007471B000-memory.dmp

    Filesize

    5.7MB

  • memory/2076-12-0x0000000074170000-0x000000007471B000-memory.dmp

    Filesize

    5.7MB

  • memory/2076-13-0x0000000074170000-0x000000007471B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.